Category — Internet

Iseng-iseng browsing tentang NAT di google, ehh ternyata ketemu tulisan saya yang udah lama kira-kira tahun 2004.

Konfigurasi Name Server Mini pada FreeBSD 4.10 Bagian I

Terlebih dahulu saya mohon izin jika tulisan ini mungkin sudah sangat basi buat para freebsd expert mania, tetapi tulisan ini sangat berguna bagi kami para pemula dalam sistim operasi freebsd ?. Tulisan ini muncul karena saya ingin membuat name server pribadi sendiri dengan menggunakan jaringan local pada satu komputer dan memiliki koneksi intenet yang fungsinya nanti bisa bermacam-macam pada jaringan tergantung kreatifitas kita seperti webserver, mailserver, server internet kalo yang ini nanti menyusul membuat server internet untuk jaringan kost-kostan Ok.. baiklah saya akan mulai dari awal nih !!! Diasumsikan kita sudah menginstall sistim operasi FreeBSD di komputer kita ? , saya sendiri menggunakan FreeBSD 4.10 yang saya install di Notebook saya dengan memakai bantuan Microsoft Virtual Server (jadi saya bisa buat jaringan virtual dengan satu PC aja .. xe xe tulisannya akan menyusul kemudian) Baiklah di sini saya menggunakan IP address 192.168.1.55 dengan Gateway 192.168.9 dan DNS 202.51.236.148 NB : Named aka otomatis terinstall sewaktu kita menginstall FreeBSD dan dapat kita cek dengan menggunakan perintah : ns1# ps ax | grep named 71 ?? Is 0:00.11 /usr/sbin/named 149 p0 S+ 0:00.01 grep named ns1# contoh di atas menyatakan bahwa named sudah terinstall dengan baik dan jika belum kita bisa install dengan cara masuk ke direktory stand dan menjalankan ./sysinstall kemudian pilih Configure dan Service serta set named enable to YES 1. Hal Pertama yaitu setting UP ip address untuk komputer Perintahnya : ns1# cd /etc ns1# ee rc.conf # This file now contains just the overrides from /etc/defaults/rc.conf. inetd_enable=”YES” kern_securelevel_enable=”NO” linux_enable=”YES” nfs_reserved_port_only=”YES” sshd_enable=”YES” ifconfig_de0=”inet 192.168.1.55 netmask 255.255.255.0″ defaultrouter=”192.168.1.9″ hostname=”ns1.rajim.net” named_enable=”YES” nah kemudian tekan CTRL + C kemudia ketik exit. Nah kemudian edit file /etc/resolv.conf dengan mengisikan nameserver menjadi 127.0.0.1 (hal ini bertujuan agar box kita dijadikan sebagai name server gitu ?) Sekarang kita akan masuk bagian konfigurasi agar localhost.rev yang nantinya berfungsi agar ip loopback 127.0.0.1 dapat di reverse ke localhost Kita masuk ke direktory /etc/namedb direktory default named ns1# cd /etc/namedb ns1# sh make-localhost ini bertujuan untuk menggenerate file localhost.rev ns1# ls PROTO.localhost-v6.rev localhost-v6.rev.BAK make-localhost PROTO.localhost.rev localhost.rev named.conf localhost-v6.rev localhost.rev.BAK named.root kemudian kita reboot pc kita agar setting yang kita buat tadi hidup, setelah itu kita aktifkan bind dengan cara mengetikkan ns1# named untuk melihat log kita dapat megetikkan ns1# tail /var/log/messages Jan 19 18:29:34 ns1 named[193]: starting (/etc/namedb/named.conf). named 8.3.7- REL Tue May 25 21:15:41 GMT 2004 root@perseus.cse.buffalo.edu:/usr/obj/us r/src/usr.sbin/named Jan 19 18:29:34 ns1 named[193]: limit files set to fdlimit (1024) Jan 19 18:29:34 ns1 named[194]: Ready to answer queries. Kemudia kita akan test nameserver kita dengan cara mengetikkan nslookup ns1# nslookup Default Server: localhost.rajim.net Address: 127.0.0.1 Atau untuk lebih jelas kita ketik host ns1# host 127.0.0.1 1.0.0.127.IN-ADDR.ARPA domain name pointer localhost.rajim.net ns1# atau juga kita bisa test host dan nslookup khan situs luar ns1# host www.yahoo.com www.yahoo.com is a nickname for www.yahoo.akadns.net www.yahoo.akadns.net has address 216.109.118.64 www………… ns1# ns1# nslookup Default Server: localhost.rajim.net Address: 127.0.0.1 > www.google.com Server: localhost.rajim.net Address: 127.0.0.1 Non-authoritative answer: Name: www.google.akadns.net Address: 64.233.189.104 Aliases: www.google.com pc kita kita sudah terinstall nameserver sekarang tinggal kreatifitas kita untuk mengembangkan pc kita untuk memberikan service2 lainnya dalam jaringan yang tentunya akan muncul pada tulisan bagian berikutnya.

Thanks to : Pak Berny, Pak Adnan & Staff UNIKOM Reverensi : Google.COm

Related posts

• Membuat Gateway/Router dengan NAT pada FreeBSD untuk server internet (2)

Iseng-iseng browsing tentang NAT di google, ehh ternyata ketemu tulisan saya yang udah lama kira-kira tahun 2004.

Hehhe.. masih ingat dengan tulisan perdana saya yang sudah ketinggalan zaman tengtang konfigurasi name server mini pada so freebsd 4.10.Pada bagian ini aku tulis lagi sambil aku lagi ngeset gateway untuk internet sharing.

Diasumsikan disini icmp tidak di blok oleh server warnet maupun dari ISP sendiri, jadi kesimpulanya dengan ip local tersebut kita bisa ping-pingan keluar lah (maksudnya bisa ngeping ke situs/ip luar contoh : ping google.com dan ngereply J). Nah seingat saya kemarin langkah pertama yaitu menjadikan freebsd kita sebagai gateway.

Nah gambaran kecil konfigurasi jaringannya adalah seperti ini :

ISP – gateway-narasumber – iplocal kita – client / kost2-an

IP ISP - 200.10.3.254 - 200.10.3.235 – 10.10.10.1

disini iplocal kita yang 200.10.3.235 akan kita setting sebuah gateway agar client ip 10.10.10.2 – 10.10.10.x bisa ngeping server narasumber terlebih dahulu, soalnya jika ngereply berarti ngeping ke ip rusia juga pasti ngereply J (logikanya)

Mesin kita tadi kita aktifkan dolo menjadi gateway, untuk mengaktifkannya kita edit rc.conf, isikan gateway_enable=�YES�

First Step : Kita aktifkan dolo nat nya pada rc.conf

defaultrouter=”200.10.3.254″

gateway_enable=”YES”

kern_securelevel_enable=”NO”

sshd_enable=”YES”

usbd_enable=”YES”

ipmon_enable=”YES”

ipmon_flags=”-Ds”

ipnat_enable=”YES”

ipnat_program=”/sbin/ipnat”

ipnat_rules=”/etc/ipnat.rules”

ipnat_flags=”"

ipmon_enable=”YES”

ipmon_program=”/sbin/ipmon”

ipmon_flags=”-Ds”

ifconfig_rl1=”inet 10.10.10.1 netmask 255.255.255.0″

ifconfig_rl0=”inet 200.10.3.235 netmask 255.255.255.0″

defaultrouter=”200.10.3.254″

hostname=”rajim.unikom.ac.id”

sshd_enable=”YES”

nah kemudian kita set ipnat.rules nya pada direktori /etc/ipnat.rules

map rl1 10.10.10.0/16 -> 200.10.3.235/32

map rl0 10.10.10.0/16 -> 200.10.3.235/32

arti tulisan diatas adalah semua paket yang datang dari ip 10.10.10.0/16 menuju keluar akan di map (dipetakan) ke ip 200.10.3.235 sehingga seolah-olah ip ini akan meneruskan request tersebut dan itulah fungsinya nat

nah sudah selesai tinggal reboot omputer nya terus pada client isikan ip gateway nya 10.10.10.1 dan coba test ping ip luar ( ingat ip bukan domain karna dns nya belum di set ). Agar dari ip 10.10.10.2 – 10.10.10.x bisa ngeping nama domain kita isikan ip dns

dari ISP karna kita belum ada nameserver, untuk client linux isikan pada resolv.conf ip nameserver nya jamin dah pasti ngereply asal dari rule yang diatas di penuhi termasuk sewaktu kita ngeping dari gateway ke ip luar.

Hehe nah kalo udah jalan tinggal kreatifitas kita ngembanginnya sebab gateway maupun router kita sudah jalan..hueuheu.Terus kita coba browsing dan chating pasti jalan tapi kemungkinan agak lag jadi di sini kita perlu pertolongan squid transparent proxy..tapi nanti dulu tunggu saya install dan konfigure dulu baru saya tulis huehueheheuehueuee yang penting client 10.10.10.2-10.10.10.x udah bisa browsing dan chat.

Thanks to : Pak Berny, Pak Adnan & Staff UNIKOM

Reverensi : Google.COm

Related posts

• Konfigurasi Name Server Mini pada FreeBSD 4.10 Bagian I (0)

Configuring BIND on RedHat (DNS under Linux)
Part 2 - Primary Name Server for a Zone

Written by Tony Bhimani
July 21, 2004

Requirements
RedHat Linux 9
BIND 9.2.1

Now we will configure BIND to be a primary name server for a single zone. I will use the fictitous domain somefakedomain.com as an example. We will add the hostnames www, ftp, and mail. We will also have BIND respond if no hostname is specified in a query (i.e. somefakedomain.com).

BIND stores its configuration data in named.conf which is located in the /etc directory. This file contains the names of the zones and location of the zone data files that it is responsible for answering queries for. The zone data files are stored by default at /var/named (although you can change this path if you wish). Before you can make any changes I will assume you know which text editor you will be using. I prefer pico, but for this tutorial I will use vi since it has a better chance of being installed by default.

Switch over to the /etc directory and open the named.conf file.

cd /etc
vi named.conf

You should see something that looks like the following.

Scroll through the file and take a look at the contents. Locate the localhost zone.

zone "localhost" IN {
	type master;
	file "localhost.zone";
	allow-update { none; };
};

Move the cursor on the blank like below the }; and press the i key. The i key puts vi in insert mode (you should see — INSERT — at the botton of vi). Press the enter key once then type in the following. Note: the spacing in front of type, file, and allow-update are tabs, so press the tab key on each of those lines.

zone "somefakedomain.com" IN {
	type master;
	file "somefakedomain.com.zone";
	allow-update { none; };
};

Be sure to put a blank line underneath the }; when you are done. It always helps to keep your files neat and clean. Now we will save the file. Press ESC and vi should leave insert mode (– INSERT — at the bottom of vi should disappear). Now type :wq and enter. vi should write our changes and exit back to the prompt.

We have told BIND that we handle the somefakedomain.com domain and the zone data is in the somefakedomain.com.zone file located at /var/named. Now we have to create the somefakedomain.com.zone file.

Switch over to /var/named and make a copy of the localhost.zone file and save it as somefakedomain.com.zone. This will give us a template to work with so we don’t have to type as much. It also saves us from changing the file’s owner, group, and permissions.

cd /var/named
cp localhost.zone somefakedomain.com.zone
vi somefakedomain.com.zone

You should get something that looks like this.

Put vi in insert mode and alter the zone file so it looks like the data below. Use tabs between items. Where I use 192.168.1.200 you should replace with your public IP address (don’t use local LAN IP’s).

$TTL 86400
$ORIGIN somefakedomain.com.
@	IN	SOA	ns1.somefakedomain.com. admin.somefakedomain.com. (
			2004042601	; serial
			21600		; refresh
			3600		; retry
			604800		; expires
			86400 )		; minimum

	IN	NS		ns1.somefakedomain.com.

	IN	MX	10	mail.somefakedomain.com.

	IN	A		192.168.1.200

ns1	IN	A		192.168.1.200
www	IN	A		192.168.1.200
ftp	IN	A		192.168.1.200
mail	IN	A		192.168.1.200

Let’s briefly go over the values (if you want more details on the contents of a zone file visit).

“ns1.somefakedomain.com.” is the name server responsible for somefakedomain.com. When you register a domain name the registrar asks you for the name servers names and IP’s. We have given our name server the name ns1 (i.e. name server 1). So if we were to register somefakedomain.com, we would use ns1.somefakedomain.com for the name and the IP address of the machine we have designated as our DNS server.

“admin.somefakedomain.com.” is the email address of the administrator in charge of the zone. You replace the @ symbol in the email address with a period. So admin@somefakedomain.com becomes admin.somefakedomain.com.

The “IN NS ns1.somefakedomain.com.” means we are declaring ns1.somefakedomain.com to be a name server.

With “IN MX 10 mail.somefakedomain.com.” we are declaring a mail exchange (or mail server) with a priority of 10. Since we only use one mail server the priority has no effect.

The “IN A 192.168.1.200″ means we are declaring a host (with no hostname, so it means somefakedomain.com) and it’s IP is 192.168.1.200. Any queries on just somefakedomain.com will resolve to 192.168.1.200. This is is useful when you configure your web server to work on somefakedomain.com or www.somefakedomain.com. They both point to the same thing and will return the same web site.

The rest of the entries mean we are declaring hosts ns1, www, ftp, and mail (ns1.somefakedomain.com, www.somefakedomain.com, ftp.somefakedomain.com, and mail.somefakedomain.com). Since they all share the same IP, each of those services will run from the same machine. If you had the mail server running on a different machine then you would substitute that machines IP address in place of 192.168.1.200. The same goes for the rest of the hosts.

When you are done editing the zone file, it should look like this.

Save it and close out of vi. Press ESC to get out of insert mode, type :wq and press enter. You should be back to the command prompt.

Now we need to tell named (BIND) to load the zone and answer any queries that come in.

/etc/init.d/named reload

Now we can test our domain using nslookup.

nslookup
server 127.0.0.1
somefakedomain.com
www.somefakedomain.com
mail.somefakedomain.com

You should see something similar to the following screen.

Everything looks good. BIND is resolving our somefakedomain.com. When you are done, type exit and press enter.

Source : http://www.xenocafe.com/tutorials/dns_linux/redhat/dns_linux_redhat-part2.php - Thx

Related posts

• No related posts.

Configuring BIND on RedHat (DNS under Linux)
Part 1 - Installing BIND on RedHat

Written by Tony Bhimani
July 21, 2004

Requirements
RedHat Linux 9
BIND 9.2.1

This tutorial describes the steps for configuring BIND 9.2.1 on RedHat Linux 9. It should be valid for other versions of BIND as well as some different distros of Linux. I will be going over setting it up as a primary and secondary name server. This tutorial spans three parts. In part 1 I will go over installing BIND and verifying the service will start on boot-up.

The first thing we will need to do is determine if BIND is already installed on your system. The method I use is to check through the RPM Package Manager. This will not work if you downloaded the BIND source code and compiled it.

Type the following at the command prompt:
rpm -qa | grep -i bind
rpm -qa | grep -i caching

If BIND is installed you should get something similar to this (ignore ypbind…it is unrelated to BIND) and you will want to skip to part 2 of this tutorial.

If BIND is not installed you will get something similar to the below image and you should keep reading.

We need to install BIND and have a few options here. We can download the source code and compile it, but we won’t take that route. We will want to install the RPM’s to keep things simple. There are a couple sources we can get the RPM’s from: download them or use the RedHat 9 CD’s. If you don’t have the RedHat 9 CD’s then you will need to download the BIND RPM’s. If you do have the CD’s then you can mount and install.

If you are not root, type su - and press enter and type in the root password (stay logged in as root for the remainder of this tutorial). Next switch to a directory where you can store the RPM’s. A good place is in your home directory under a folder called RPM. You can accomplish this by issuing the following commands.

cd ~
mkdir RPM
cd RPM

Choose your install method:

Install from CD
Download and Install the BIND RPM’s

Install from CD

The BIND RPM’s are located on the first CD and the caching name server and BIND development RPM’s are located on the second CD. What we will do is mount the first CD, copy of BIND RPM’s to the RPM folder we created, and unmount the CD. Then mount the next CD and copy the caching name server and BIND development RPM’s to the RPM folder and unmount that CD. Then we will proceed to the install section.

Put the RedHat 9 CD 1 in your CD-ROM drive and issue the following command.

mount -t iso9660 /dev/cdrom /mnt/cdrom

If your drive mounted then you should see something similar to the following.

Next copy the BIND RPM’s to your RPM folder.
cp /mnt/cdrom/RedHat/RPMS/bind-*.rpm .

We are now done with CD 1, so we can unmount it.

umount /mnt/cdrom

Put the RedHat 9 CD 2 in your CD-ROM drive and issue the following command.

mount -t iso9660 /dev/cdrom /mnt/cdrom

Next copy the caching name server and BIND development RPM’s to your RPM folder.

cp /mnt/cdrom/RedHat/RPMS/bind-devel-9.2.1-16.i386.rpm .
cp /mnt/cdrom/RedHat/RPMS/caching-nameserver-7.2-7.noarch.rpm .

Now unmount the CD-ROM with umount /mnt/cdrom and take the CD out of the drive.

When you are done, do a directory list (ls) and you should have all four files.

Now that you have the RPM’s it is time to actually install them. Go to the installation part.

Download and Install the BIND RPM’s

I offer you two ways of downloading the RPM’s. Using wget or using a FTP client. In my opinion using wget is far easier then using the basic FTP client that comes with RedHat. With wget you just supply the URL and it fetches the file for you. With the basic FTP client you have to issue more commands than I’m sure you’d like to. First thing you should do is check if you have wget on your system. Type wget and press enter. If you don’t get a command not found error then it is installed and you should proceed to the wget section. If you do get the command not found error, you have no choice but to use the FTP client. In either case you will need to know where to download the RPM’s from.

RedHat provides a list of mirror sites at http://www.redhat.com/download/mirror.html where you can choose where to download the RPM’s (or ISO images) from. The server we will use is mirror.mcs.anl.gov and the full path to the RPM’s isftp://mirror.mcs.anl.gov/pub/redhat/redhat/linux/9/en/os/i386/RedHat/RPMS/.

We want to download the following files:
bind-9.2.1-16.i386.rpm
bind-devel-9.2.1-16.i386.rpm
bind-utils-9.2.1-16.i386.rpm
caching-nameserver-7.2-7.noarch.rpm

Download by wget
Download by FTP Client

Download by wget

Issue these commands one at a time.

wget ftp://mirror.mcs.anl.gov/pub/redhat/redhat/linux/9/en/os/i386/RedHat/RPMS/bind-9.2.1-16.i386.rpm
wget ftp://mirror.mcs.anl.gov/pub/redhat/redhat/linux/9/en/os/i386/RedHat/RPMS/bind-devel-9.2.1-16.i386.rpm
wget ftp://mirror.mcs.anl.gov/pub/redhat/redhat/linux/9/en/os/i386/RedHat/RPMS/bind-utils-9.2.1-16.i386.rpm
wget ftp://mirror.mcs.anl.gov/pub/redhat/redhat/linux/9/en/os/i386/RedHat/RPMS/caching-nameserver-7.2-7.noarch.rpm

You should get something similar to the following for each file you download.

When you are done, do a directory list (ls) and you should have all four files.

Now that you have the RPM’s it is time to actually install them. Go to the installation part.

Download by FTP Client

I guess you don’t have wget. No problem! FTP isn’t that bad, there is just more typing involved. Type the following commands to download the RPM’s.

ftp mirror.mcs.anl.gov

It then asks for a username, type anonymous and press enter. Then it will ask for your email address as a password. Type in your email address and press enter.

Once you are logged in, issue these commands one at a time.

bin
hash
cd /pub/redhat/redhat/linux/9/en/os/i386/RedHat/RPMS/
get bind-9.2.1-16.i386.rpm
get bind-devel-9.2.1-16.i386.rpm
get bind-utils-9.2.1-16.i386.rpm
get caching-nameserver-7.2-7.noarch.rpm

During each file download you will see a bunch of # symbols scroll by. This is just a text based progress bar. I find it helpful to let me know if a download has stalled. If you don’t want to use the hash marks, type hash off and press enter.

You should receive screens similar to the following.

After you have retreived all four files, type quit and press enter. Do a directory list (ls) and you should have all four files.

Now that you have the RPM’s it is time to actually install them.

Installing the BIND RPM’s

Whichever path you chose, whether downloading the RPM’s or installing from CD, you should be in the same directory where they are located. To install the RPM’s you issue the following command.

rpm -ivh bind-*.rpm caching-nameserver-7.2-7.noarch.rpm

You should get something a screen similar to the following.

To verify the RPM’s installed successfully, issue the following commands.

rpm -qa | grep -i bind
rpm -qa | grep -i caching

BIND should now be installed and you should get a screen similar to the following.

Now we need to make sure the BIND service starts upon boot-up. To do this we will use chkconfig and tell the OS to start named (BIND) to start on runlevels 3 and 5. For more information about runlevels and the Linux boot process visit this site http://www.siliconvalleyccie.com/linux-hn/runlevels.htm.

Issue the following commands to chkconfig to turn named (BIND) on for runlevels 3 and 5. Then we will verify they have been turned on.

chkconfig –levels 35 named on
chkconfig –list | grep -i named

I should also mention instead of using chkconfig you could have used the RedHat Text Mode Setup Utility. From the command line type setup and press enter. Scroll down to System Services and press enter. Scroll down to named and press the spacebar to put a check on it. Press tab, enter, tab, tab, enter. You should be back to the prompt. Verify that named will boot-up. Note: If you didn’t install X Windows, runlevel 5 may not be turned on. This is ok because runlevel 5 is Multi-User GUI mode.

Everything looks good. Now we will start BIND and verify it is running.

/etc/init.d/named start
ps aux | grep -i named

That’s all for part 1. In part 2 I will cover setting up BIND as a primary name server for a single zone.

Related posts

• No related posts.

 Trik Agar IP Local Dapat Dilihat Oleh IP Luar

Artikel ini sengaja aku tulis karena biar tidak lupa bila suatu saat aku berhadapan dengan kasus ini lagi. Permasalahan nya adalah ketika kita cuma dikasih satu IP Address Publik oleh pihak ISP. Untuk menyiasati hal ini, agar beberapa server kita (Web Server, FTP server, Email Server) yang ada di IP lokal bisa diakses oleh Internet kita dapat menggunakan salah satu aplikasi dilinux yang sudah terkenal bandel…

Bagaimana caranya?

Solusinya adalah dengan NAT (Network Address Translation) yaitu mentranslasikan suatu IP Address ke sisi jaringan yang lain. Pada sistem Operasi Linux kita dapat melakukannya secara standard dengan menggunakan tools iptables. iptables sebagai tools pengatur trafik jaringan memiliki kemampuan untuk melakukan hal tersebut. iptables dijalankan dari sisi server akan meneruskan traffik yang merekues dari sisi publik/internet diteruskan ke sisi lokal.

Sehingga sintaksnya akan menjadi seperti demikian

iptables -t nat -I PREROUTING -p tcp -s IP_Publik_Yang_Merekuest –dport Port_Tujuan -j DNAT –to-destination IP_Lokal_tujuan:Port_aplikasinya

Penjelasan

-t nat = table nat pada iptables
-I PREROUTING = Insert pada chain Prerouting
-p tcp = protokol tcp
-s = Source/sumber Ip address yang merekues. Kalau semua diijinkan = 0/0
–dport = port tujuan yang diminta dari sisi publik
-j DNAT = Target Destination NAT
–to-destination = ke tujuan ip lokal yang diinginkan

Misal kita memiliki ip publik202.130.202.111 dan webserver ada pada sisi lokal 192.168.0.250 maka kita bisa melakukan seperti ini

iptables - t nat -I PREROUTING -p tcp -s 0/0 –dport 80 -j DNAT –to-destination 192.168.0.250:80

Atau jika port 80 telah digunakan oleh server itu sendiri, kitabisa memanfaatkan port yang kosong dari sisi server tersebut misal

iptables - t nat -I PREROUTING -p tcp -s 0/0 –dport 88 -j DNAT –to-destination 192.168.0.250:80

Namun, proses pemanggilan dalam browser harus lengkap menggunakan port

http://202.130.202.111:88

Ya, langkah ini juga bisa di balik apabila seorang administrator jaringan ingin merouting jaringan, agar rekuest ke port tertentu, dapat dialihkan ke route lain, namun logika dibalik dan port destination di belakang di hilangkan. Contoh:

iptables -t nat -I PREROUTING -p tcp -s 192.168.0.0/24 –dport 80 -j DNAT –to-destination 202.130.202.111

Langkah ini juga bisa di gunakan untuk protokol lain juga selain web seperti ssh, remote server dal protokol lainnya.

Sumber : http://intrix.wordpress.com — Thx

Related posts

• No related posts.